[selinux-policy/f21] * Fri Mar 09 2015 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-105.7 - Allow spamc read spamd_etc_t file
Lukas Vrabec
lvrabec at fedoraproject.org
Mon Mar 9 12:24:06 UTC 2015
commit 39d9eccfce859a432c198ccbdd22f70e3c153368
Author: Lukas Vrabec <lvrabec at redhat.com>
Date: Mon Mar 9 13:23:49 2015 +0100
* Fri Mar 09 2015 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-105.7
- Allow spamc read spamd_etc_t files. BZ(1199339).
- Allow collectd to write to smnpd_var_lib_t dirs. BZ(1199278)
- Allow abrt_watch_log_t read passwd file. BZ(1197396)
- Allow abrt_watch_log_t to nsswitch_domain. BZ(1199659)
- Allow cups to read colord_var_lib_t files. BZ(1199765)
policy-f21-contrib.patch | 149 ++++++++++++++++++++++++++---------------------
selinux-policy.spec | 9 ++-
2 files changed, 91 insertions(+), 67 deletions(-)
---
diff --git a/policy-f21-contrib.patch b/policy-f21-contrib.patch
index 3cfdf70..77b0978 100644
--- a/policy-f21-contrib.patch
+++ b/policy-f21-contrib.patch
@@ -539,7 +539,7 @@ index 058d908..1e92177 100644
+')
+
diff --git a/abrt.te b/abrt.te
-index eb50f07..9b65c9f 100644
+index eb50f07..984adc8 100644
--- a/abrt.te
+++ b/abrt.te
@@ -6,11 +6,10 @@ policy_module(abrt, 1.4.1)
@@ -1039,7 +1039,7 @@ index eb50f07..9b65c9f 100644
#######################################
#
-@@ -404,7 +510,7 @@ logging_read_generic_logs(abrt_dump_oops_t)
+@@ -404,25 +510,54 @@ logging_read_generic_logs(abrt_dump_oops_t)
#
allow abrt_watch_log_t self:fifo_file rw_fifo_file_perms;
@@ -1048,7 +1048,11 @@ index eb50f07..9b65c9f 100644
read_files_pattern(abrt_watch_log_t, abrt_etc_t, abrt_etc_t)
-@@ -413,16 +519,42 @@ domtrans_pattern(abrt_watch_log_t, abrt_dump_oops_exec_t, abrt_dump_oops_t)
++auth_read_passwd(abrt_watch_log_t)
++auth_use_nsswitch(abrt_watch_log_t)
++
+ domtrans_pattern(abrt_watch_log_t, abrt_dump_oops_exec_t, abrt_dump_oops_t)
+
corecmd_exec_bin(abrt_watch_log_t)
logging_read_all_logs(abrt_watch_log_t)
@@ -1092,7 +1096,7 @@ index eb50f07..9b65c9f 100644
')
#######################################
-@@ -430,10 +562,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
+@@ -430,10 +565,7 @@ tunable_policy(`abrt_upload_watch_anon_write',`
# Global local policy
#
@@ -14512,7 +14516,7 @@ index 954309e..6780142 100644
')
+
diff --git a/collectd.te b/collectd.te
-index 6471fa8..74ffeda 100644
+index 6471fa8..32e85d5 100644
--- a/collectd.te
+++ b/collectd.te
@@ -26,43 +26,59 @@ files_type(collectd_var_lib_t)
@@ -14584,7 +14588,7 @@ index 6471fa8..74ffeda 100644
logging_send_syslog_msg(collectd_t)
-@@ -75,16 +91,31 @@ tunable_policy(`collectd_tcp_network_connect',`
+@@ -75,16 +91,35 @@ tunable_policy(`collectd_tcp_network_connect',`
')
optional_policy(`
@@ -14596,6 +14600,10 @@ index 6471fa8..74ffeda 100644
+')
+
+optional_policy(`
++ snmp_read_snmp_var_lib_dirs(collectd_t)
++')
++
++optional_policy(`
virt_read_config(collectd_t)
+ virt_stream_connect(collectd_t)
')
@@ -19706,7 +19714,7 @@ index 3023be7..0317731 100644
+ files_var_filetrans($1, cupsd_rw_etc_t, dir, "cups")
')
diff --git a/cups.te b/cups.te
-index c91813c..e3f01e3 100644
+index c91813c..8b03359 100644
--- a/cups.te
+++ b/cups.te
@@ -5,19 +5,31 @@ policy_module(cups, 1.16.2)
@@ -19979,7 +19987,7 @@ index c91813c..e3f01e3 100644
selinux_compute_access_vector(cupsd_t)
selinux_validate_context(cupsd_t)
-@@ -244,23 +287,28 @@ auth_dontaudit_read_pam_pid(cupsd_t)
+@@ -244,22 +287,27 @@ auth_dontaudit_read_pam_pid(cupsd_t)
auth_rw_faillog(cupsd_t)
auth_use_nsswitch(cupsd_t)
@@ -20001,18 +20009,17 @@ index c91813c..e3f01e3 100644
userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
+userdom_dontaudit_search_user_home_dirs(cupsd_t)
-+userdom_dontaudit_search_user_home_content(cupsd_t)
-+userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
userdom_dontaudit_search_user_home_content(cupsd_t)
-
++userdom_dontaudit_use_unpriv_user_fds(cupsd_t)
++userdom_dontaudit_search_user_home_content(cupsd_t)
++
+tunable_policy(`cups_execmem',`
+ allow cupsd_t self:process { execmem execstack };
+')
+
-+
+
optional_policy(`
apm_domtrans_client(cupsd_t)
- ')
@@ -272,6 +320,8 @@ optional_policy(`
optional_policy(`
dbus_system_bus_client(cupsd_t)
@@ -20022,7 +20029,14 @@ index c91813c..e3f01e3 100644
userdom_dbus_send_all_users(cupsd_t)
optional_policy(`
-@@ -282,8 +332,10 @@ optional_policy(`
+@@ -279,11 +329,17 @@ optional_policy(`
+ ')
+
+ optional_policy(`
++ colord_read_lib_files(cupsd_t)
++ ')
++
++ optional_policy(`
hal_dbus_chat(cupsd_t)
')
@@ -20033,7 +20047,7 @@ index c91813c..e3f01e3 100644
')
')
-@@ -296,8 +348,8 @@ optional_policy(`
+@@ -296,8 +352,8 @@ optional_policy(`
')
optional_policy(`
@@ -20043,7 +20057,7 @@ index c91813c..e3f01e3 100644
')
optional_policy(`
-@@ -306,7 +358,6 @@ optional_policy(`
+@@ -306,7 +362,6 @@ optional_policy(`
optional_policy(`
lpd_exec_lpr(cupsd_t)
@@ -20051,7 +20065,7 @@ index c91813c..e3f01e3 100644
lpd_read_config(cupsd_t)
lpd_relabel_spool(cupsd_t)
')
-@@ -334,7 +385,11 @@ optional_policy(`
+@@ -334,7 +389,11 @@ optional_policy(`
')
optional_policy(`
@@ -20064,7 +20078,7 @@ index c91813c..e3f01e3 100644
')
########################################
-@@ -342,12 +397,11 @@ optional_policy(`
+@@ -342,12 +401,11 @@ optional_policy(`
# Configuration daemon local policy
#
@@ -20080,7 +20094,7 @@ index c91813c..e3f01e3 100644
allow cupsd_config_t cupsd_t:process signal;
ps_process_pattern(cupsd_config_t, cupsd_t)
-@@ -372,18 +426,16 @@ manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run
+@@ -372,18 +430,16 @@ manage_dirs_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run
manage_files_pattern(cupsd_config_t, cupsd_config_var_run_t, cupsd_config_var_run_t)
files_pid_filetrans(cupsd_config_t, cupsd_config_var_run_t, { dir file })
@@ -20101,7 +20115,7 @@ index c91813c..e3f01e3 100644
corenet_all_recvfrom_netlabel(cupsd_config_t)
corenet_tcp_sendrecv_generic_if(cupsd_config_t)
corenet_tcp_sendrecv_generic_node(cupsd_config_t)
-@@ -392,20 +444,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
+@@ -392,20 +448,12 @@ corenet_tcp_sendrecv_all_ports(cupsd_config_t)
corenet_sendrecv_all_client_packets(cupsd_config_t)
corenet_tcp_connect_all_ports(cupsd_config_t)
@@ -20122,7 +20136,7 @@ index c91813c..e3f01e3 100644
fs_search_auto_mountpoints(cupsd_config_t)
domain_use_interactive_fds(cupsd_config_t)
-@@ -417,11 +461,6 @@ auth_use_nsswitch(cupsd_config_t)
+@@ -417,11 +465,6 @@ auth_use_nsswitch(cupsd_config_t)
logging_send_syslog_msg(cupsd_config_t)
@@ -20134,7 +20148,7 @@ index c91813c..e3f01e3 100644
userdom_dontaudit_use_unpriv_user_fds(cupsd_config_t)
userdom_dontaudit_search_user_home_dirs(cupsd_config_t)
userdom_read_all_users_state(cupsd_config_t)
-@@ -449,9 +488,12 @@ optional_policy(`
+@@ -449,9 +492,12 @@ optional_policy(`
')
optional_policy(`
@@ -20148,7 +20162,7 @@ index c91813c..e3f01e3 100644
')
optional_policy(`
-@@ -467,6 +509,10 @@ optional_policy(`
+@@ -467,6 +513,10 @@ optional_policy(`
')
optional_policy(`
@@ -20159,7 +20173,7 @@ index c91813c..e3f01e3 100644
rpm_read_db(cupsd_config_t)
')
-@@ -487,10 +533,6 @@ optional_policy(`
+@@ -487,10 +537,6 @@ optional_policy(`
# Lpd local policy
#
@@ -20170,7 +20184,7 @@ index c91813c..e3f01e3 100644
allow cupsd_lpd_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
allow cupsd_lpd_t { cupsd_etc_t cupsd_rw_etc_t }:dir list_dir_perms;
-@@ -508,15 +550,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
+@@ -508,15 +554,15 @@ stream_connect_pattern(cupsd_lpd_t, cupsd_var_run_t, cupsd_var_run_t, cupsd_t)
kernel_read_kernel_sysctls(cupsd_lpd_t)
kernel_read_system_state(cupsd_lpd_t)
@@ -20188,7 +20202,7 @@ index c91813c..e3f01e3 100644
corenet_tcp_sendrecv_ipp_port(cupsd_lpd_t)
corenet_sendrecv_printer_server_packets(cupsd_lpd_t)
-@@ -537,9 +579,6 @@ auth_use_nsswitch(cupsd_lpd_t)
+@@ -537,9 +583,6 @@ auth_use_nsswitch(cupsd_lpd_t)
logging_send_syslog_msg(cupsd_lpd_t)
@@ -20198,7 +20212,7 @@ index c91813c..e3f01e3 100644
optional_policy(`
inetd_service_domain(cupsd_lpd_t, cupsd_lpd_exec_t)
')
-@@ -550,7 +589,6 @@ optional_policy(`
+@@ -550,7 +593,6 @@ optional_policy(`
#
allow cups_pdf_t self:capability { chown fowner fsetid setuid setgid dac_override };
@@ -20206,7 +20220,7 @@ index c91813c..e3f01e3 100644
allow cups_pdf_t self:unix_stream_socket create_stream_socket_perms;
append_files_pattern(cups_pdf_t, cupsd_log_t, cupsd_log_t)
-@@ -566,148 +604,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
+@@ -566,148 +608,23 @@ fs_search_auto_mountpoints(cups_pdf_t)
kernel_read_system_state(cups_pdf_t)
@@ -20235,11 +20249,13 @@ index c91813c..e3f01e3 100644
- fs_manage_cifs_dirs(cups_pdf_t)
- fs_manage_cifs_files(cups_pdf_t)
-')
--
--optional_policy(`
++userdom_home_manager(cups_pdf_t)
+
+ optional_policy(`
- lpd_manage_spool(cups_pdf_t)
--')
--
++ gnome_read_config(cups_pdf_t)
+ ')
+
-########################################
-#
-# HPLIP local policy
@@ -20345,20 +20361,18 @@ index c91813c..e3f01e3 100644
-optional_policy(`
- seutil_sigchld_newrole(hplip_t)
-')
-+userdom_home_manager(cups_pdf_t)
-
- optional_policy(`
+-
+-optional_policy(`
- snmp_read_snmp_var_lib_files(hplip_t)
-+ gnome_read_config(cups_pdf_t)
- ')
-
+-')
+-
-optional_policy(`
- udev_read_db(hplip_t)
-')
########################################
#
-@@ -735,7 +648,6 @@ kernel_read_kernel_sysctls(ptal_t)
+@@ -735,7 +652,6 @@ kernel_read_kernel_sysctls(ptal_t)
kernel_list_proc(ptal_t)
kernel_read_proc_symlinks(ptal_t)
@@ -20366,7 +20380,7 @@ index c91813c..e3f01e3 100644
corenet_all_recvfrom_netlabel(ptal_t)
corenet_tcp_sendrecv_generic_if(ptal_t)
corenet_tcp_sendrecv_generic_node(ptal_t)
-@@ -745,13 +657,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
+@@ -745,13 +661,11 @@ corenet_sendrecv_ptal_server_packets(ptal_t)
corenet_tcp_bind_ptal_port(ptal_t)
corenet_tcp_sendrecv_ptal_port(ptal_t)
@@ -20380,7 +20394,7 @@ index c91813c..e3f01e3 100644
files_read_etc_runtime_files(ptal_t)
fs_getattr_all_fs(ptal_t)
-@@ -759,8 +669,6 @@ fs_search_auto_mountpoints(ptal_t)
+@@ -759,8 +673,6 @@ fs_search_auto_mountpoints(ptal_t)
logging_send_syslog_msg(ptal_t)
@@ -20389,7 +20403,7 @@ index c91813c..e3f01e3 100644
sysnet_read_config(ptal_t)
userdom_dontaudit_use_unpriv_user_fds(ptal_t)
-@@ -773,3 +681,4 @@ optional_policy(`
+@@ -773,3 +685,4 @@ optional_policy(`
optional_policy(`
udev_read_db(ptal_t)
')
@@ -96590,7 +96604,7 @@ index 1499b0b..6950cab 100644
- spamassassin_role($2, $1)
')
diff --git a/spamassassin.te b/spamassassin.te
-index cc58e35..b1878b4 100644
+index cc58e35..1a685ab 100644
--- a/spamassassin.te
+++ b/spamassassin.te
@@ -7,50 +7,23 @@ policy_module(spamassassin, 2.6.1)
@@ -96894,7 +96908,7 @@ index cc58e35..b1878b4 100644
')
########################################
-@@ -167,72 +248,92 @@ optional_policy(`
+@@ -167,72 +248,95 @@ optional_policy(`
# Client local policy
#
@@ -96946,6 +96960,9 @@ index cc58e35..b1878b4 100644
+read_files_pattern(spamc_t, spamd_spool_t, spamd_spool_t)
+list_dirs_pattern(spamc_t, spamd_spool_t, spamd_spool_t)
+
++allow spamc_t spamd_etc_t:dir list_dir_perms;
++allow spamc_t spamd_etc_t:file read_file_perms;
++
+# Allow connecting to a local spamd
+allow spamc_t spamd_t:unix_stream_socket connectto;
+allow spamc_t spamd_tmp_t:sock_file rw_sock_file_perms;
@@ -96995,20 +97012,20 @@ index cc58e35..b1878b4 100644
-auth_use_nsswitch(spamc_t)
+fs_search_auto_mountpoints(spamc_t)
-+
-+libs_exec_ldconfig(spamc_t)
- logging_send_syslog_msg(spamc_t)
+-logging_send_syslog_msg(spamc_t)
++libs_exec_ldconfig(spamc_t)
-miscfiles_read_localization(spamc_t)
-+auth_use_nsswitch(spamc_t)
++logging_send_syslog_msg(spamc_t)
-tunable_policy(`use_nfs_home_dirs',`
- fs_manage_nfs_dirs(spamc_t)
- fs_manage_nfs_files(spamc_t)
- fs_manage_nfs_symlinks(spamc_t)
-')
--
++auth_use_nsswitch(spamc_t)
+
-tunable_policy(`use_samba_home_dirs',`
- fs_manage_cifs_dirs(spamc_t)
- fs_manage_cifs_files(spamc_t)
@@ -97018,7 +97035,7 @@ index cc58e35..b1878b4 100644
optional_policy(`
abrt_stream_connect(spamc_t)
-@@ -243,6 +344,7 @@ optional_policy(`
+@@ -243,6 +347,7 @@ optional_policy(`
')
optional_policy(`
@@ -97026,7 +97043,7 @@ index cc58e35..b1878b4 100644
evolution_stream_connect(spamc_t)
')
-@@ -251,10 +353,16 @@ optional_policy(`
+@@ -251,10 +356,16 @@ optional_policy(`
')
optional_policy(`
@@ -97044,7 +97061,7 @@ index cc58e35..b1878b4 100644
sendmail_stub(spamc_t)
')
-@@ -267,36 +375,40 @@ optional_policy(`
+@@ -267,36 +378,40 @@ optional_policy(`
########################################
#
@@ -97071,17 +97088,17 @@ index cc58e35..b1878b4 100644
allow spamd_t self:unix_dgram_socket sendto;
-allow spamd_t self:unix_stream_socket { accept connectto listen };
-allow spamd_t self:tcp_socket { accept listen };
--
++allow spamd_t self:unix_stream_socket connectto;
++allow spamd_t self:tcp_socket create_stream_socket_perms;
++allow spamd_t self:udp_socket create_socket_perms;
+
-manage_dirs_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_lnk_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_fifo_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-manage_sock_files_pattern(spamd_t, spamd_home_t, spamd_home_t)
-userdom_user_home_dir_filetrans(spamd_t, spamd_home_t, dir, ".spamd")
-+allow spamd_t self:unix_stream_socket connectto;
-+allow spamd_t self:tcp_socket create_stream_socket_perms;
-+allow spamd_t self:udp_socket create_socket_perms;
-
+-
-manage_dirs_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
-manage_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
-manage_lnk_files_pattern(spamd_t, spamassassin_home_t, spamassassin_home_t)
@@ -97102,7 +97119,7 @@ index cc58e35..b1878b4 100644
logging_log_filetrans(spamd_t, spamd_log_t, file)
manage_dirs_pattern(spamd_t, spamd_spool_t, spamd_spool_t)
-@@ -308,7 +420,8 @@ manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
+@@ -308,7 +423,8 @@ manage_dirs_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
manage_files_pattern(spamd_t, spamd_tmp_t, spamd_tmp_t)
files_tmp_filetrans(spamd_t, spamd_tmp_t, { file dir })
@@ -97112,7 +97129,7 @@ index cc58e35..b1878b4 100644
manage_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
manage_lnk_files_pattern(spamd_t, spamd_var_lib_t, spamd_var_lib_t)
-@@ -317,12 +430,13 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
+@@ -317,12 +433,13 @@ manage_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
manage_sock_files_pattern(spamd_t, spamd_var_run_t, spamd_var_run_t)
files_pid_filetrans(spamd_t, spamd_var_run_t, { file dir })
@@ -97128,7 +97145,7 @@ index cc58e35..b1878b4 100644
corenet_all_recvfrom_netlabel(spamd_t)
corenet_tcp_sendrecv_generic_if(spamd_t)
corenet_udp_sendrecv_generic_if(spamd_t)
-@@ -331,78 +445,59 @@ corenet_udp_sendrecv_generic_node(spamd_t)
+@@ -331,78 +448,59 @@ corenet_udp_sendrecv_generic_node(spamd_t)
corenet_tcp_sendrecv_all_ports(spamd_t)
corenet_udp_sendrecv_all_ports(spamd_t)
corenet_tcp_bind_generic_node(spamd_t)
@@ -97232,7 +97249,7 @@ index cc58e35..b1878b4 100644
')
optional_policy(`
-@@ -421,21 +516,13 @@ optional_policy(`
+@@ -421,21 +519,13 @@ optional_policy(`
')
optional_policy(`
@@ -97256,7 +97273,7 @@ index cc58e35..b1878b4 100644
')
optional_policy(`
-@@ -443,8 +530,8 @@ optional_policy(`
+@@ -443,8 +533,8 @@ optional_policy(`
')
optional_policy(`
@@ -97266,7 +97283,7 @@ index cc58e35..b1878b4 100644
')
optional_policy(`
-@@ -455,7 +542,17 @@ optional_policy(`
+@@ -455,7 +545,17 @@ optional_policy(`
optional_policy(`
razor_domtrans(spamd_t)
razor_read_lib_files(spamd_t)
@@ -97285,7 +97302,7 @@ index cc58e35..b1878b4 100644
')
optional_policy(`
-@@ -463,9 +560,9 @@ optional_policy(`
+@@ -463,9 +563,9 @@ optional_policy(`
')
optional_policy(`
@@ -97296,7 +97313,7 @@ index cc58e35..b1878b4 100644
')
optional_policy(`
-@@ -474,32 +571,32 @@ optional_policy(`
+@@ -474,32 +574,32 @@ optional_policy(`
########################################
#
@@ -97339,7 +97356,7 @@ index cc58e35..b1878b4 100644
corecmd_exec_bin(spamd_update_t)
corecmd_exec_shell(spamd_update_t)
-@@ -508,25 +605,21 @@ dev_read_urand(spamd_update_t)
+@@ -508,25 +608,21 @@ dev_read_urand(spamd_update_t)
domain_use_interactive_fds(spamd_update_t)
diff --git a/selinux-policy.spec b/selinux-policy.spec
index ddf0623..03605cb 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -19,7 +19,7 @@
Summary: SELinux policy configuration
Name: selinux-policy
Version: 3.13.1
-Release: 105.6%{?dist}
+Release: 105.7%{?dist}
License: GPLv2+
Group: System Environment/Base
Source: serefpolicy-%{version}.tgz
@@ -604,6 +604,13 @@ SELinux Reference policy mls base module.
%endif
%changelog
+* Fri Mar 09 2015 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-105.7
+- Allow spamc read spamd_etc_t files. BZ(1199339).
+- Allow collectd to write to smnpd_var_lib_t dirs. BZ(1199278)
+- Allow abrt_watch_log_t read passwd file. BZ(1197396)
+- Allow abrt_watch_log_t to nsswitch_domain. BZ(1199659)
+- Allow cups to read colord_var_lib_t files. BZ(1199765)
+
* Thu Mar 05 2015 Lukas Vrabec <lvrabec at redhat.com> 3.13.1-105.6
- Allow glusterd_t exec glusterd_var_lib_t files. BZ(1198406)
- Add gluster_exec_lib interface.
More information about the scm-commits
mailing list